972986c050b90491166e62088e7a534d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

972986c050b90491166e62088e7a534d_JaffaCakes118
Size

670KB
MD5

972986c050b90491166e62088e7a534d
SHA1

d1d2b1d65fc847b35aa12daebf9566134dac7392
SHA256

7a39c7d9dc3125241138e9fa59f3c964e82b12076e795799157a6a5154fda55d
SHA512

84c70f22ea348d07e47e848381fae0c10cf0bb9de099516478025424849e1a1fa2571e46418537ed63003f11b0d5f5ca7544edd9d09519cbf66973ce670fa0ff
SSDEEP

12288:7kmuhpIpZrv7L3xk1TZ9VgCjAzXACyVV7c71SuWb72A2Q8pHrr+8FHsI6H1YwIXU:7UIpZrve1w1+ujVsI6H1Ywy9MNIoPGY0

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
972986c050b90491166e62088e7a534d_JaffaCakes118

Files

972986c050b90491166e62088e7a534d_JaffaCakes118
.dll windows:5 windows x86 arch:x86

273ee63a431ed8f926862f28e3afa6bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\source\converterapp\rel32\converterapp.pdb

Imports

ole32

StringFromGUID2
DoDragDrop
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoInitialize
CoUninitialize

kernel32

GetProcessHeap
lstrcpyW
FindClose
FindNextFileA
FindFirstFileA
GetProcAddress
GetTempPathA
SetEvent
CreateEventA
FreeLibrary
LoadLibraryA
GetCurrentProcessId
GetVersionExA
SuspendThread
ResumeThread
SetThreadPriority
GetThreadPriority
TryEnterCriticalSection
CreateMutexA
ReleaseMutex
ResetEvent
GetDiskFreeSpaceA
GetDriveTypeA
DeleteFileA
GetFileSize
GetFileAttributesA
CreateDirectoryA
MoveFileA
GetWindowsDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
SetErrorMode
GetSystemInfo
GetVersion
GetSystemDirectoryA
CreateProcessW
GetEnvironmentVariableA
GetModuleHandleExA
GetLocaleInfoA
GetLocaleInfoW
HeapFree
DisableThreadLibraryCalls
InterlockedIncrement
LocalFree
HeapSize
HeapReAlloc
HeapDestroy
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
HeapAlloc
CreateFileA
ReadFile
GetCurrentThreadId
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetTickCount
IsDBCSLeadByte
GetModuleFileNameA
GetModuleHandleA
lstrlenW
lstrcmpiA
WideCharToMultiByte
CreateThread
InterlockedDecrement
RaiseException
GetLastError
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
CloseHandle
TerminateThread
WaitForSingleObject
MultiByteToWideChar
lstrlenA
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
Sleep

user32

IsIconic
SendMessageA
SetPropA
GetParent
CharNextA
UpdateWindow
RegisterWindowMessageA
RegisterClassExA
GetClassInfoExA
CreateWindowExA
DefWindowProcA
DestroyWindow
UnregisterClassA
ShowWindow
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
FlashWindow
wsprintfA
CharPrevA
PeekMessageA
PostMessageA
CharLowerA
CharUpperA
RegisterClipboardFormatA
SystemParametersInfoA
GetSystemMetrics
GetKeyState
RemovePropA
GetWindowThreadProcessId
GetMessageA
DispatchMessageA
PostThreadMessageA
GetPropA

winmm

timeGetTime

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

comdlg32

GetOpenFileNameW

msvcr90

?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
__clean_type_info_names_internal
_itoa
_mkdir
_rmdir
isspace
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_unlink
_getcwd
_chdir
_putenv
__CppXcptFilter
??3@YAXPAX@Z
_purecall
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??_V@YAXPAX@Z
memcpy_s
_wcsicmp
_invalid_parameter_noinfo
memmove_s
free
calloc
_recalloc
__CxxFrameHandler3
strchr
malloc
strcpy_s
strncpy_s
_time32
??_U@YAPAXI@Z
_resetstkoflw
atof
atol
strtok
_strdup
_except_handler4_common
memset
_localtime64_s
printf
_time64
_stricmp
atoi
strstr
_strlwr
_beginthreadex
strtoul
wcsnlen
memcpy
??0exception@std@@QAE@ABQBDH@Z
strnlen
remove
_vscwprintf
vswprintf_s
tolower
memmove
realloc
_ismbcspace
sprintf
_vsnprintf
strncmp
strtol
_stat32
fclose
fread
_errno
fopen
ftell
fseek
fputs
getenv
_chmod
rename
strrchr
_ismbblead
strncpy
_atoi64
isalpha
_strnicmp
fopen_s
fprintf
_vsnprintf_s
isalnum
fscanf
wcsstr
_access
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer

msvcp90

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegCreateKeyA
RegOpenKeyA
RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegDeleteKeyA

shell32

SHGetFileInfoA
ShellExecuteA
DragAcceptFiles
SHBrowseForFolderA
SHGetFolderPathA
SHGetPathFromIDListA
SHGetMalloc

oleaut32

SysAllocStringLen
SysAllocString
SysFreeString
VariantInit
VariantClear
VariantCopy
VariantChangeType
SysStringLen
GetErrorInfo
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr

shlwapi

PathStripToRootA
PathAppendA
PathAddBackslashW
PathAddBackslashA
PathStripPathW
PathStripPathA
PathRemoveExtensionW
PathRemoveExtensionA
PathFindExtensionW
PathCombineW
PathAppendW
PathFileExistsA
PathFileExistsW
PathFindFileNameA

wininet

InternetGetConnectedState

Exports

Exports

RMACreateInstance
RMAShutdown
SetDLLAccessPath

Sections

.text
Size: 425KB - Virtual size: 424KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 25KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

273ee63a431ed8f926862f28e3afa6bc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ole32

kernel32

user32

winmm

version

comdlg32

msvcr90

msvcp90

advapi32

shell32

oleaut32

shlwapi

wininet

Exports

Exports

Sections

.text Size: 425KB - Virtual size: 424KB

.rdata Size: 73KB - Virtual size: 72KB

.data Size: 25KB - Virtual size: 27KB

.rsrc Size: 103KB - Virtual size: 102KB

.reloc Size: 42KB - Virtual size: 42KB

.text
Size: 425KB - Virtual size: 424KB

.rdata
Size: 73KB - Virtual size: 72KB

.data
Size: 25KB - Virtual size: 27KB

.rsrc
Size: 103KB - Virtual size: 102KB

.reloc
Size: 42KB - Virtual size: 42KB